Run a hunt that could have failed

short · 50 min · Objective 1.4

Task

Write a falsifiable hypothesis, hunt it across your lab, and record the outcome as one of three things -- found it, proved it absent, or could not tell. The third outcome is the one that produces the most valuable finding, and the one most hunts quietly avoid reporting.

Steps

  1. Write a hypothesis precise enough to be wrong. Not "look for suspicious PowerShell" but: "If an attacker were using encoded PowerShell for execution on these hosts, I would see a process creation event with an encoded argument, parented by something other than an interactive shell."
  2. Before you search, write down what evidence would confirm it, what would refute it, and what would mean you cannot tell.
  3. Run the hunt. Search the whole retention window, not just today.
  4. Record the outcome honestly against your three pre-written criteria.
  5. Whatever the result, produce two outputs: a detection rule if you found something findable, and a telemetry gap finding if any part of the hunt could not be answered from the data you hold.
  6. Repeat with a second hypothesis aimed at something you know is absent, and confirm your method returns "proved absent" rather than "found nothing".

Verify

grep -icE "encodedcommand|[[:space:]]-enc[[:space:]]" /var/log/collected/windows.log
awk '{print $1}' /var/log/collected/windows.log | sort -u | head -1
awk '{print $1}' /var/log/collected/windows.log | sort -u | tail -1

The first is your hunt result. The second and third bound your search window, and they are the reason the hunt can claim anything at all: a hunt that found nothing across two hours of logs has proved nothing, and one that found nothing across the full retention has proved something specific and limited.

Notes

Write the finding as a sentence with its bounds in it: "No encoded PowerShell execution on these two hosts between the 3rd and the 17th, from process creation events with command line capture enabled." That sentence is defensible. "No sign of compromise" is not, and is the same overreach the reporting lessons are about.

Keep the telemetry gap. A hunt that produces a gap finding has paid for itself even when it finds no attacker.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.